Ubuntu
ufw package

ufw fails when connection tracking is not available

Bug #289906 reported by Jamie Strandboge
4
Affects Status Importance Assigned to Milestone
ufw (Ubuntu)
Fix Released
Medium
Jamie Strandboge

Bug Description

Binary package hint: ufw

Some virtual server providers do not supply netfilter connection tracking as part of their kernel. Sometimes the kernels are monolithic as well. Contents of /proc/net/ is:
$ ls -l /proc/net
total 0
-r--r--r-- 1 root root 0 Oct 27 15:51 anycast6
-r--r--r-- 1 root root 0 Oct 27 15:51 arp
-r--r--r-- 1 root root 0 Oct 27 15:51 dev
-r--r--r-- 1 root root 0 Oct 27 15:51 dev_mcast
dr-xr-xr-x 2 root root 0 Oct 27 15:51 dev_snmp6
-r--r--r-- 1 root root 0 Oct 27 15:51 if_inet6
-r--r--r-- 1 root root 0 Oct 27 15:51 igmp
-r--r--r-- 1 root root 0 Oct 27 15:51 igmp6
-r--r----- 1 root root 0 Oct 27 15:51 ip_conntrack
-r--r----- 1 root root 0 Oct 27 15:51 ip_conntrack_expect
-r--r----- 1 root root 0 Oct 27 15:51 ip_tables_matches
-r--r----- 1 root root 0 Oct 27 15:51 ip_tables_names
-r--r----- 1 root root 0 Oct 27 15:51 ip_tables_targets
-r--r--r-- 1 root root 0 Oct 27 15:51 ipv6_route
-r--r--r-- 1 root root 0 Oct 27 15:51 mcfilter
-r--r--r-- 1 root root 0 Oct 27 15:51 mcfilter6
-r--r--r-- 1 root root 0 Oct 27 15:51 netstat
-r--r--r-- 1 root root 0 Oct 27 15:51 packet
-r--r--r-- 1 root root 0 Oct 27 15:51 raw
-r--r--r-- 1 root root 0 Oct 27 15:51 raw6
-r--r--r-- 1 root root 0 Oct 27 15:51 route
-r--r--r-- 1 root root 0 Oct 27 15:51 rt_cache
-r--r--r-- 1 root root 0 Oct 27 15:51 snmp
-r--r--r-- 1 root root 0 Oct 27 15:51 snmp6
-r--r--r-- 1 root root 0 Oct 27 15:51 sockstat
dr-xr-xr-x 2 root root 0 Oct 27 15:51 stat
-r--r--r-- 1 root root 0 Oct 27 15:51 tcp
-r--r--r-- 1 root root 0 Oct 27 15:51 tcp6
-r--r--r-- 1 root root 0 Oct 27 15:51 udp
-r--r--r-- 1 root root 0 Oct 27 15:51 udp6
-r--r--r-- 1 root root 0 Oct 27 15:51 unix

nf_conntrack is not listed, but should be. ufw should check for this and give a helpful error message.

Related branches

lp:ubuntu/karmic/ufw
Jamie Strandboge (jdstrand)
Changed in ufw:
assignee: nobody → jdstrand
importance: Undecided → Medium
status: New → Triaged
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

This is the command that failed (with the ufw-before-input chain confirmed to exist):
# iptables -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables: No chain/target/match by that name

Jamie Strandboge (jdstrand)
Changed in ufw:
status: Triaged → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ufw - 0.24

---------------
ufw (0.24) jaunty; urgency=low

  * debian/rules: check for 'nocheck' in DEB_BUILD_OPTIONS
  * debian/postrm: don't fail if iptables or ip6tables fails (LP: #278670)
  * fix typo in error message (LP: #280348)
  * allow case-insensitive matches for application rules (LP: #263757). Based
    on work by Didier Roche
  * add skel-ui for UI example
  * debian/postinst: don't stop in runlevels 0 and 6 (LP: #298736)
  * before6.rules: adjust hop limit to 255 for NDP messages (LP: #299268) per
    RFC 4890 secton 4.2. Thanks to Ryan Giobbi
  * before6.rules: restrict multicast (LP: #304216). Thanks to Ryan Giobbi
  * before.rules: don't use ctstate as it is not supported on all kernels and
    we don't use the extra information anyway (LP: #289906)
  * fix translations for input strings (LP: #302426)
  * update ucf md5sums for before.rules and before6.rules
  * adjust root/destructive tests for when we can't unmount /proc

 -- Jamie Strandboge <email address hidden> Fri, 12 Dec 2008 13:43:11 -0500

Changed in ufw:
status: Fix Committed → Fix Released
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

For user's of earlier versions of ufw, you can work around this by adjusting these lines in /etc/ufw/before.rules:
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m conntrack --ctstate INVALID -j LOG --log-prefix "[UFW BLOCK INVALID]: "
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP

to be:
-A ufw-before-input -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m state --state INVALID -j LOG --log-prefix "[UFW BLOCK INVALID]: "
-A ufw-before-input -m state --state INVALID -j DROP

Of course, your kernel must be configured for stateful filtering for this to work.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.